1. Field of the Invention
This invention relates generally to methods and systems for providing data communications through a network. A particular aspect of the invention relates to key management methods for wireless local area networks.
2. Description of the Related Art
In general, Wireless Local Area Networks (WLAN) are similar to conventional wired Ethernet Local Area Networks (LANs) in many respects. The primary distinction, of course, is that communications and access to the network for mobile terminals in a WLAN does not require a physical connection. Indeed, several Mobile Terminals (MTs) may access the network over the same frequency and air space.
There are two different WLAN types. An ad-hoc WLAN is a simple network where communications are established between multiple mobile terminals without the use of an access point or server. The other WLAN type, client-server networks, have a basic architecture as generally illustrated in FIG. 1. An Access Point (AP) serves as a base station to control and coordinate the transmission states of the various mobile terminals within a Basic Service Set (BSS). The access point usually supervises them when they roam from cell to cell. The access points also provide the mobile terminals with access to the WLAN and handle data traffic between to the wired or wirelss backbone (BB).
The access points also route and control the flow of traffic between mobile terminals in the WLAN and other networks. Just as in wired networks, an internetworking unit (IWU) uses protocol manipulation to connect the WLAN to a network with a different protocol. Some internetworking units are relatively common, such as IP routers which are used to connect LANs to the Internet via an Internet Service Provider (ISP).
The layer stack for a typical WLAN-IP Router-Internet connection is as shown in FIG. 2. As in any network, the bottom physical layer (PHY) defines the modulation and signaling characteristics for the transmission of data. In a WLAN, the physical layer defines such characteristics as transmission frequency, bandwidth and data rates, power output limits and spread spectrum techniques. Much as in an Ethernet network, the primary function of the next to bottom Media Access Control (MAC) layer is to prevent collisions between mobile terminals attempting to transmit data at the same time. An additional function of the MAC layer in a WLAN is power management and battery operation of the mobile terminals.
A relatively large number number of different WLAN products are currently available. Unfortunately, these products are developed by different manufacturers and are generally incompatible with each other. The Institute for Electrical and Electronic Engineers (IEEE) has recently completed development of its 802.11 WLAN standard which defines physical layer options for transferring data frames at 2.4 Ghz and sets forth MAC layer protocols. The 802.11 standard also includes certain network management services, registration and authentication services. Another emerging WLAN standard is the High Performance Radio Local Area Network (HIPERLAN2) for broadband data transmission at 5 GHz.
Regardless of the physical layer and MAC layer specifications, data transmission security is an essential part of WLAN development. Since there are no physical connections required and the mobile terminals use a wireless link to access the WLAN via an access point, additional security features are used to protect transmitted data and network elements. These features include data and signaling encryption at the MAC layer, authentication of the mobile terminal when it connects to the network, and the authentication of each data packet to assure that the packet was sent by the claimed mobile terminal. The mobile terminal can also authenticate the network (that is, the access point) and the received packets.
Some security provisions are included as an optional part of the IEEE 802.11 WLAN standards. In particular, data security on the wireless link level can be accomplished by a complex encryption technique known as Wired Equivalent Privacy (WEP). WEP protects the data transmitted over the shared frequency and air space using a 64-bit seed key and the RC4 encryption algorithm. A pseudo-random number generator is initialized by a shared secret key and outputs a key sequence of pseudo-random bits equal in length to the largest possible packet which is combined with the outgoing/incoming packet producing the packet transmitted in the air.
When enabled, WEP only protects the data packet information from being captured by other mobile terminals (or similar equipment) for eavesdropping or other purposes and does not protect the physical layer header. Although the other mobile terminals on the network cannot decrypt the data portions of the packet, they can listen to the control data needed to manage the network. WEP also does not prevent unauthorized access to the network.
Similar to wired LANs, most WLANs require a mobile terminal registering itself with the network, such as through an access point, to authenticate itself as an authorized user by providing a password. As another measure of security, a WLAN may additionally or alternatively require a mobile terminal to use a current ciphering “key” before obtaining access to the network.
Currently available WLAN products typically use symmetric pre-distributed keys. In other words, the mobile terminal's ciphering key is stored in the mobile terminal itself and is distributed to all of the access points by the network manager. These products have the drawback that it is unpractical to change the key frequently. Usually the key is created by the network manager when the mobile terminal is used for the first time, and is never changed after that. It also becomes difficult to manage the keys when the wireless network grows to be large in size.